|
|
|
Modeling the Security Module Realm with OntoStudio |
|
|
|
|
Modeling the Security Module Realm with OntoStudio |
It is possible to edit the security ontology realm (which is ObjectLogic based) directly with OntoStudio. The schema of the security ontology is defined in $security-core.obl (which is per default in the "conf" directory). If you want to be able to edit the security ontology via OntoStudio you have to import the schema ontology. E.g.
:- module = '$security'.
:-prefix = "http://ontoprise.de/security#".
:-import = '$security-core'.
demo:User[hasRole->{m1all,m2read,foo}].
root:User[hasRole->allModules].
m1all:Role[hasReadPermission->m1; hasTempWritePermission->m1; hasWritePermission->m1].
m3read:Role[hasReadPermission->m3].
m3write:Role[hasWritePermission->m3].
foo:Role[hasPermission->'foo:*'].
The third line shows the required import. Here is a screenshot of the schema of the security ontology:
The following excerpt shows the ObjectLogic source of the schema ontology:
:- version("2.0").
:- encoding("Cp1252").
:- module = $'security-core'.
// Concept hierarchy ------------------------------------
Module[].
Role[].
User[].
Role[hasReadPermission {0:*} *=> Module].
Role[hasWritePermission {0:*} *=> Module].
Role[hasTempWritePermission {0:*} *=> Module].
Role[hasPermission {0:*} *=> WildcardPermission].
User[hasRole {0:*} *=> Role].
SpecialPermission::WildcardPermission.
// Instances --------------------------------------------
"*":Module.
allModules:Role.
allPermissions:Role.
"ob:command:apicommands":SpecialPermission.
"ob:command:busy":SpecialPermission.
"ob:command:clear":SpecialPermission.
"ob:command:commands":SpecialPermission.
...
The most important concepts are:
| • | User (a user can have multiple roles) |
| • | Role (a rule consists of zero or more permissions) |
| • | Module (known modules are instances of this concept) |
To model your security ontology you also have to open the schema ontology and the ontologies for which you want to set the roles and permissions. Here is a screenshot of OntoStudio in which a security ontology is edited:
The changes in the security ontology (roles and permissions) are executed immediately when a permission/role is changed. Hence, it is possible to try out new permissions immediately by executing queries.